... and a notion of "special data property" which used to represent
JavaScript spec compliant native data properties. Now all data
properties in V8 are spec-compliant.
Drive-by:
- remove deprecated typedefs v8::AccessorGetterCallback and
v8::AccessorSetterCallback,
- start deprecation of v8::AccessControl enum.
Bug: 336325111
Change-Id: Ie31ac57b40a4fdd5277aaa6e0283a68fb4a0daac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5607994
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94367}
Simplification:
- a tighter intergration with the ApiCallbackExitFrame's layout,
where the v8::FunctionCallbackInfo<T> object and its fields have
dedicated locations addressable via fp,
- unification of the Generic and Optimized versions of the builtin,
- don't store the number of bytes to drop on the stack, use
FunctionCallbackInfo::length_ instead,
- cleaner code,
- it's no longer necessary to attach a frame state when inlining an
Api call into optimized code in order to support
--experimental-stack-trace-frames.
Optimization:
- avoid passing argc and v8::FunctionTemplateInfo twice to the Generic
version,
- less code for both generic and optimized versions.
Bug: 326505377
Change-Id: I426459f2784e42c0b1bfcb39259fd04e3512feea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5587866
Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94361}
... and replace usages with GetPrototypeV2(). The difference between
the two is that the former returns JSGlobalObject for JSGlobalProxy
while the latter behaves like JavaScript's Object.getPrototypeOf(..)
and thus never returns JSGlobalObject.
This is a step towards never exposing JSGlobalObject via Api.
This CL updates usages in tests non-involving global object and
suppresses the deprecation warnings for tests involving global object.
Bug: 333672197
Change-Id: I7b1cb4c5b7234613a39f652fd9bb8d7b8839a3fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5600627
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94295}
... and replace usages with SetPrototypeV2(). The difference between
the two is that the former works for JSGlobalObject (both as receiver
and prototype value) while the latter behaves like JavaScript's
Object.setPrototypeOf(..) and hits a CHECK failure in case
JSGlobalObject is provided.
This is a step towards never exposing JSGlobalObject via Api.
This CL updates usages in tests non-involving global object and
suppresses the deprecation warnings for tests involving global object.
Bug: 333672197
Change-Id: I053599548ce5b9f7c37bd8927b4d0253e313729e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5600626
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94290}
... and introduce a replacement HolderV2() which never returns
JSGlobalObject. The new Api is not optimized for performance yet.
Bug: 333672197
Change-Id: I214eb38946d93d932aeaf7e18001767912979041
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5600766
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94289}
This should reduce the overhead of Api function calls with enabled
profiling since we don't have to iterate the stack anymore in order
to get current FunctionTemplateInfo.
Bug: 326505377
Change-Id: I937be23925a8ba11b0a9409c31a364a7b7a98799
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5587864
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94215}
Instead of passing FunctionTemplateInfo::callback_data field directly
in v8::FunctionCallbackInfo structure we now pass the target
FunctionTemplateInfo while still allowing lazy access to the data
value via the target.
The motivation is:
- given that the data value is not needed for Blink's hot Api
functions we can avoid eager loading of the data value
in CallApiCallbackGeneric and thus improve non-optimized case,
- doing so will allow us to remove the second copy of the
FunctionTemplateInfo that was saved on the stack for
CallApiCallbackGeneric in order to support (currently disabled)
--experimental-stack-trace-frames,
- being able to reach the FunctionTemplateInfo allows us to
preprocess exceptions thrown from Api functions more lazily and
reduce the work on Blink side,
- it will allow us to reduce overhead of Api calls in generic case
when profiling is enabled.
Bug: 326505377, 328104148
Change-Id: I1a05e55ca9730077dc6e6fe1c940f8a1384a4aff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5587862
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94212}
... and duplicate callback data parameter for fast mode calls.
This is a preparation for passing FunctionTemplateInfo to slow mode
builtins (CallApiCallbackOptimizedXXX) instead of callback data
without changing behavior for fast Api calls.
Bug: 326505377
Change-Id: Idcdb56fdb707a778e2217f6338f93108449ccaf9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5587861
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94208}
These methods will be removed in V8 12.8.
Also deprecate unused v8::AccessorGetterCallback and
v8::AccessorSetterCallback typedefs and a v8::PropertyCallbackInfo
constructor.
Bug: 336325111
Change-Id: Id16269213072dd1c18672d2fbd5c9997187e6c19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5587951
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94193}
This will allow stack iterator to get to the v8::PropertyCallbackInfo
object (and later to AccessorInfo object corresponding to the property
being accessed). This is necessary for preprocessing exceptions thrown
from Api functions more lazily and reduce the work on Blink side.
Bug: 328104148
Change-Id: I685c8eebafab5b0459f401f7934e5dd272ca3020
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5587947
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94192}
This CL makes the following changes:
- adds explicit scratch register argument to Enter/LeaveExitFrame,
- removes argument dropping from LeaveExitFrame which makes it uniform
with other main architectures and unblocks accessing the exit frame
arguments after the exit frame is dropped,
- refactors register usage in CEntry implementation,
- uses ExternalReferenceAsOperand(ER, no_reg) to generate less
instructions.
Bug: 328104148
Change-Id: I3333ea2f05e999fd405565d2d5dcfeba21e3c080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5570125
Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94081}
... and remove v8::ObjectTemplate::SetIndexedPropertyHandler() which
was deprecated in V8 12.6.
The old indexed interceptors Api will be removed in V8 12.8.
Bug: 328490288
Change-Id: I8b030ef3199a08bbee80221cdaabcd2235233f47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5465513
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93937}
... in inspector tests and use SetNativeDataProperty(..) instead.
In case the setter callback is not provided, SetNativeDataProperty(..)
installs a setter callback that reconfigures the property to a true
data property and thus subsequent reads will no longer trigger the
original getter callback.
Bug: 336325111
Change-Id: I5e53ad3d106bec89e3b294420b6813d8311bfe97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5512705
Reviewed-by: Simon Zünd <szuend@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93751}
... and an overload of
v8::Object::GetAlignedPointerFromEmbedderDataInCreationContext()
with v8::Isolate* parameter.
Bug: 336738728
Change-Id: Ia780e99671b51499d3be6a7b6b44665b183c336b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5484027
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93713}
... for interceptor tests.
The getter/setter callbacks were used for checking whether the get/set
request was correctly handled by interceptor in a child object.
The usual replacement SetNativeDataProperty(..) doesn't fit here
because according to JavaScript spec the setter callback should not be
called in case a property is stored to a child object.
So, the tests are updated to use JavaScript accessor callbacks instead.
Bug: 336325111
Change-Id: I8ac6f160635cf1fbbbf90e7037bea18f076cc630
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5498423
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93674}
Despite a slight difference in behaviour of data properties defined
via the former from data properties defined via the latter the tests
updated in this CL don't depend on this difference.
So it's just a trivial renaming.
Bug: 336325111
Change-Id: I940f22ae94c3f2eae78a8585a0efa6f299b2674f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5498424
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93673}
... in favour of %GetCallable(target_name).
d8.dom.Document_all was defined as undetectable which immediately
invalidated the NoUndetectableObjects protector. The CL where it was
introduced regressed benchmarks, this should hopefully recover some
of the regression.
The existing %GetCallable(target_name) function was changed to return
a callable object that redirects [[Call]] requests to
globalThis[target_name] function.
Update existing tests accordingly.
Bug: 335544085
Change-Id: Idd6140c38d6a3fc4cbe4b0a0ac6a8aa4d8a76f62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5505451
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93672}
The IsJSFuncton() predicate returns true for class constructors which
are not callable and thus are not expected by CallFunction builtins.
This CL introduces IsCallableJSFuncton() predicate and fixes handling
of class constructors installed as property accessors which was broken
in https://crrev.com/c/5458075.
Bug: 336852492
Change-Id: I3042bbc543bb34a2109fbbf95673201cceaf23a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5490093
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93613}
In case new.target is a constructor function without prototype slot
(i.e. Proxy constructor) we should query the "prototype" property.
Bug: v8:14707
Change-Id: Ice55e13aa230a2a5f4a29296a13160ab7fab9ae3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5461559
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93435}
For accessors, instead of storing the descriptor index + holder in the
StoreHandler, store the setter directly (avoiding the
map->descriptor->pair->setter hops). For the non-prototype case, where
there's no StoreHandler, store the AccessorPair directly as a weak
handler instead of the Smi handler. We can't store the setter here
directly, because it could be in new space, and then we can't use it in
the stub cache.
This is a follow-up for http://crrev.com/c/3865557.
Change-Id: I96e0cb4f55c2745a968e8e54e2e674132eaea770
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5458514
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93431}
... and use it in IC dispatchers for calling getters and setters which
are known to be JSFunctions.
Use ConvertReceiverMode::kNotNullOrUndefined when applicable.
In case a non-JSFunction callable object is installed as getter or
setter slow stub is used. In order to test this functionality
the CL adds d8.dom.Document_all callable Api object which gets/sets
`globalThis.document_all_property` depending on number of arguments.
Change-Id: Id03b00e3dce848f1e53763b0293860bac1d48910
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5458075
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93417}
... in favour of v8::FunctionCallbackInfo::This().
This is a next step towards never exposing so-called hidden prototype
(i.e. JSGlobalObject) via the V8 Api. This will make the JSGlobalObject
a V8 internal thing and make the V8 Api closer to JavaScript spec.
Embedders that store pointers to C++ objects in JSGlobalObject's
internal fields should migrate their code to store the pointers in
internal fields of JSGlobalProxy (AKA v8::Context::Global()).
It's not allowed to use V8_DEPRECATE_SOON functionality in V8 tests,
so this CL temporarily introduces HolderSoonToBeDeprecated() method
preserving the old semantics in order to keep testing the old
machinery until all embedders are migrated to the new Api.
Bug: chromium:333672197
Change-Id: I0d555c8e95c55c46bff71f6db768573c3146deed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5444829
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93327}
... as a replacement for soon to be deprecated
v8::Object::GetPrototype() and v8::Object::SetPrototype().
The new versions will act just like getting/setting of "__proto__"
property, i.e. they will never return or accept JSGlobalObject.
This is a first step towards never exposing so-called hidden prototype
(i.e. JSGlobalObject) via the V8 Api. This will make the JSGlobalObject
a V8 internal thing and make the V8 Api closer to JavaScript spec.
Bug: chromium:333672197
Change-Id: Ic850d6a041f443392586b868eccde637ded801d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5447696
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93325}
Use empty string as an anonymous class name when parsing instead of
nullptr. This makes class parsing and reparsing code uniform (the
latter gets the class name from SharedFunctionInfo where the anonymous
class' name is set to an empty string).
Bug: chromium:329693878
Change-Id: I3272f21d8000ec1c7f5dfb315277630974b917f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5380193
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#93122}
... which were marked as V8_DEPRECATE_SOON in 12.1 and 12.4.
This CL deprecates
v8::Template::SetNativeDataProperty(v8::Local<v8::String>, ...);
v8::ObjectTemplate::SetAccessor(v8::Local<v8::String>, ...);
and
v8::Template::SetNativeDataProperty(...); with AccessControl parameter.
Additionally, the CL marks the following typedefs as V8_DEPRECATE_SOON
v8::AccessorGetterCallback,
v8::AccessorSetterCallback.
Bug: chromium:326505377
Change-Id: If6f30b3aba9f55785c573faf4a307c6de0d175ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5383482
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92974}
... and mark the old interceptors Api as V8_DEPRECATE_SOON.
Drive-by: use anonymous namespaces instead of `static` in tests.
Bug: chromium:328490288
Change-Id: I58d40618048195e1243ec72c14fad830a59663f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5372060
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92939}
... in order to be able to mark the old interceptors Api as
V8_DEPRECATE_SOON.
Drive-by: use anonymous namespaces instead of `static` in tests.
Bug: chromium:328490288
Change-Id: Ieadd0016bf6afa676b6543cc10053afbd7a59137
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5374905
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92897}
... in order to be able to mark the old interceptors Api as
V8_DEPRECATE_SOON.
Drive-by: use anonymous namespaces instead of `static` in tests.
Bug: chromium:328490288
Change-Id: Ib74d222f479e2f714bc6998d58a4468040b63985
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5374903
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92886}
The new callback should return bool value indicating whether the
operation was intercepted. This replaces the old approach where
the callback used to return the hole value if the request wasn't
intercepted.
The new Api will allow us to remove the hole check for Api function
callback and native data properties accessor callbacks.
Tests will be migrated to the new Api in follow-up CLs.
Bug: chromium:328490288
Change-Id: I9dab518fd3b43daeee6a08a2781a5f0688619144
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5355689
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92733}
The new callback should return bool value indicating whether the
operation was intercepted. This replaces the old approach where
the callback used to return the hole value if the request wasn't
intercepted.
The new Api will allow us to remove the hole check for Api function
callback and native data properties accessor callbacks.
Tests will be migrated to the new Api in follow-up CLs.
Bug: chromium:328490288
Change-Id: I6446529bbd454c698a2432566be853baa68a2f6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5353146
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92732}
It's been a while since a more generic accessor callbacks accepting
Local<Name> were introduced, so it's time to deprecate the old ones.
This CL deprecates
v8::Template::SetNativeDataProperty(v8::Local<v8::String>, ...);
v8::ObjectTemplate::SetAccessor(v8::Local<v8::String>, ...);
Bug: chromium:326505377
Change-Id: Ie2d10de0625d64d40ea526fa05e94dc8fdf5fe51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5344409
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92668}
This CL ensures that the upper 32-bits of the ReturnValue<T> are never
ever modified by making SetInternal() function a bottleneck and using
it everywhere.
The issue was that setting a Smi value corrupted the upper 32-bits
and subsequent setting of an undefined/null/true/false didn't
recover them.
Drive-by: use SetNonEmpty() for relevant use cases.
Bug: v8:14445
Change-Id: I7f3da1469afed2f5c23e670e13ef89fdd7bf573a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5331689
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92621}
... which will allow to remove one indirection when calling Api
functions.
This CL
- introduces custom visitor for FunctionTemplateInfo,
- stores flags, length and instance type values as raw data and
packs length and instance type into 32-bits value,
- stores FunctionTemplateInfo instead of CallHandlerInfo as an
instance call handler for callable ObjectTemplates.
The latter comes with a memory overhead because FunctionTemplateInfo is
bigger than CallHandlerInfo but it's ok since callable ObjectTemplates
are rarely used in practice. It also temporarily adds an additional
indirection when calling callable Api objects until the CallHandlerInfo
is inlined into FunctionTemplateInfo.
Bug: chromium:326505377
Change-Id: I0a6645f228f413ff5412403e05aee1dfceb65966
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5329250
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92597}
... by moving internal object allocation from api.cc to Factory.
This CL is a preliminary cleanup before inlining CallHandlerInfo object
into FunctionTemplateInfo.
Drive-by fixes:
- remove unused TemplateInfo::tag field,
- fix broken instance type range check for FunctionTemplateInfo,
- untie embedder-provided instance types from V8-internal
instance type range of JSApiObjects and expect value in the
range [0, 1000] as proposed in the design doc (see v8:11476).
Bug: chromium:326505377, v8:11476
Change-Id: I109d8cc8b11f61389be58f6e5a7984dbeb8d3c41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5317945
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92545}
... which missed some cases that required rehasing according to
HeapObject::NeedsRehashing().
This CL also adds a PushParamsAndDie instrumentation in order to
investigate attempts to rehash objects with non-existing instance
type values.
Bug: chromium:326043780
Change-Id: Ie13af1c335fcbf816e2de66d97ccb964d5d5fc9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5309919
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92434}
... in case it's an imported JSFunction. This is simpler than creating
a wrapper and setting its context. This also avoids breaking the
invariant about native context-specific maps:
function->map->meta_map->native_context == function->native_context.
Drive-by: module's start function is a one-shot one, so we can clear
it once it's called.
Bug: chromium:1522153
Change-Id: Ic86a793ada04e4c9efa812378188a6797632a95f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5245552
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#92071}
DefineOwnICs have to handle stores to a non-enumerable properties
differently than StoreICs. The former must reconfigure the property
attributes to NONE while the latter can just store a value there.
Due to the above reason it's not correct to reuse StoreIC handlers
for DefineOwnICs, so this CL introduces a separate megamorphic stub
cache for DefineOwnICs.
This CL partially reverts https://crrev.com/c/5147214 because proto
handlers are actually used by DefineOwnICs for transitioning element
stores (see StoreHandler::StoreElementTransition).
Drive-by: fix printing of Define(Keyed|Named)OwnIC states.
Bug: v8:14493, chromium:1512391
Change-Id: Ia9f8ed731dfc1e45bb10f3b668734ddda27359b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5217052
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91939}
... for all JSApiObjects (all of them are allowed to have inobject
properties, not just the first one - JS_API_OBJECT_TYPE).
Bug: chromium:1509910
Change-Id: Ie6a801ddc743372c7013ed020634e50dca5e2ed4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5147787
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91629}
... in order to ensure that it's stashed with the other execution
state data when an Isolate is unlocked.
Add test/cctest/test-api-incumbent.cc with more tests for
Isolate::GetIncumbentContext() including a regression test for this
issue.
Bug: v8:13825
Change-Id: If6c5c7aec2793af98ae914bc47735ed025a5a1e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5077502
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91481}
... in order to make the layout of IsolateData in memory more
predictable so that we can ensure that the fields that are updated
together don't cross the CPU cache line boundary (assuming it's 64
bytes). This should make performance slightly less flaky.
Also group fields that are updated together
- on every CEntry/CallApiCallback/CallApiGetter
(see MacroAssembler::EnterExitFrame/LeaveExitFrame),
- on every MacroAssembler::CallCFunction.
Bug: v8:13825
Change-Id: I74a1f0b47fa3ef793391b2c99438b7209be1a87c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5116498
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91477}
... instead of CallStub/TailCallStub(Callable&, ...).
This will allow CSA to control which builtin calls/tailcalls what and
ensure that propagation of incumbent context through builtins is
correct.
Drive-by:
- introduce code-stub-assembler-inl.h,
- make it possible to call CodeAssembler::CallJS() not only with
CallTrampoline descriptor (without new_target parameter) but also
with JSTrampoline one (with new_target parameter).
Bug: v8:14496
Change-Id: I4391d310364d5a134af6647d45817adfa05c845b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5077500
Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91431}
... instead of CallStub/TailCallStub(Callable&, ...).
This will allow CSA to control which builtin calls/tailcalls what and
ensure that propagation of incumbent context through builtins is
correct.
Bug: v8:14496
Change-Id: Ief3c858d422a34fd9a6eff2df60548eae87a2ab8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5077499
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91369}
... instead of CallStub/TailCallStub(Callable&, ...) and
Call/Jump(Handle<Code>, ...) for calling CEntry variants.
This will allow CSA to control which builtin calls/tailcalls what and
ensure that propagation of incumbent context through builtins is
correct.
Bug: v8:14496
Change-Id: I974e34a6459ce179f3afc18b0d38e7fceaa1a53a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5081997
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91368}
... instead of CallStub/TailCallStub(Callable&, ...).
This will allow CSA to control which builtin calls/tailcalls what and
ensure that propagation of incumbent context through builtins is
correct.
Bug: v8:14496
Change-Id: I01b1d14521831ab2c4bc2294c960d50f495dcef5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5079351
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91353}
... instead of CallStub/TailCallStub(Callable&, ...).
This will allow CSA to control which builtin calls/tailcalls what and
ensure that propagation of incumbent context through builtins is
correct.
Bug: v8:14496
Change-Id: Idafc2d7966117b43c379f80d88f0a021a0855dcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5080875
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91345}
Use Builtins::Call/CallFunction instead of CodeFactory versions.
Drive-by:
- in Generate_InterpreterPushArgsThenCallImpl use Call with given
convert receiver mode instead of generic
Call(ConvertReceiverMode::kAny) (x64 did it right unlike other
architectures),
- remove unnecessary jump in Generate_CallOrConstructForwardVarargs.
Bug: v8:14496
Change-Id: I13b0c18e25c5e63d8f8ff0326e8518728942f349
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5080235
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91333}
... instead of Call/Jump via Handle<Code>. The latter ends up in the
former anyway but after several unnecessary checks.
Drive-by:
- introduce builtins-inl.h and move there constexpr methods that
compute Builtin id from various other parameters,
- rename Builtins::GetXXXStub(...) to just Builtins::XXX(...).
Bug: v8:14496
Change-Id: Icc229c916a894a9f9011e72540ec6bea987eb50e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5079307
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91310}
The serialization machinery does not support forward references in
the map slot, i.e. when serialization of a map's map could cause
serialization of the map itself.
However with contextful meta maps this could potentially happen
because of the following reference chain:
MAP -> meta map -> NativeContext -> ... -> MAP
We break this cycle by deferring serialization of the meta map's
native context.
Bug: chromium:1495743, v8:14460
Change-Id: I125cf7a6eedb085c26f27b3a7037088f92cf00b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5054540
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#91160}
This CL simplifies implementation of JSReceiver::GetCreationContext()
which now loads creation context via
object -> map -> meta map -> native context
instead of walking back the transition tree to the root map to get
the constructor to read the context from.
Bug: chromium:1495743
Change-Id: I466ddb05e4774ab134a436656569f536727d707e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5030191
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#90934}
... objects that must be tied to some native context.
The following JSReceiver objects are the exceptions:
- JSObjects allocated in shared space,
- remote Api objects,
- JSMessageObject and JSExternalObject (they are just wrappers around
a set of primitive values and exist only for the purpose of passing
the data across V8 Api).
JSReceiver::GetCreationContext() still uses the old machinery but in
a follow-up CL it'll be replaced with a constant time version loading
the native context via
object -> map -> meta map -> native context
Bug: chromium:1495743
Change-Id: I9f4765ca4a102d3617c5485e87b60471b5214387
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5017893
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#90919}
... and use them for all Context maps. Previously there was only one
meta map referencing itself via the map field.
Note that since meta map is not unique anymore the IsMap(obj)
predicate must check instance type.
This is a first step towards using native context specific meta maps
for all objects tied to a certain native context. This will allow us
to compute object's creation context in constant time via just the
following hops:
object -> map -> meta map -> native context
Bug: chromium:1495743
Change-Id: If145c676677e77e2236591387a2c406634b50ff7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5017773
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#90891}
This is a reland of commit 3281d2b6b0
The temporary fix is to disable code space compaction when
--maglev-inline-api-calls is enabled.
Original change's description:
> [maglev] Fix inlining Api call builtin
>
> ... which didn't work when the Maglev code had to be lazy
> deoptimized.
>
> Bug: v8:13825, chromium:1445925, chromium:1496606
> Change-Id: I640791a0ce1f8180cdc280382c0f7b0e5668d5dd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4994337
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#90715}
Bug: v8:13825, chromium:1445925, chromium:1496606
Change-Id: Ic2c08540e6095d21d58c2e6058fe14006cd6ac5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5003146
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#90763}
... and miss/put new handlers into the cache.
This improves manual property copying pattern where the KeyedStoreIC
becomes megamorphic because it sees different names while the target
object shape and a set of property names are mostly the same.
The idea is that in certain cases it's still cheaper to compute a
handler, put it into the megamorphic cache and perform lookups instead
of always doing a runtime call. This CL uses conservative approach and
enables such lookups only for JSApiObjects which usually have accessor
properties backed by Api functions in the prototype chain.
This CL improves Speedometer2.1/Inferno-TodoMVC by ~2-4%.
Change-Id: I08538d9533bb897df1d08940535cba1a3d8205a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4906266
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#90386}
... when IC is called from an inlined function. Previous implementation
loaded feedback vector from an IC caller's frame's JSFunction instead
of using an explicitly provided one.
Drive-by: unify tracing output.
Change-Id: Iab72162ed0f3f64f783130aac84a27fdebfebded
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4906275
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#90239}
This CL introduces PtrComprCageAccessScope which sets/restores current
thread's pointer compression cage base values. It's supposed to be used
by V8 jobs accessing V8 heap outside of v8::Isolate::Scope or
i::LocalHeap or i::LocalIsolate scopes (they already ensure that the
cage base values are properly initialized).
For all other build modes PtrComprCageAccessScope is a no-op.
For simplicity reasons the multi-cage mode is made incompatible with
external code space.
Bug: v8:13788, v8:14292
Change-Id: I06c2d19a1eb7254fa7af07a17617e22d98abea9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4846592
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#90075}
The ConstructByArrayLike case didn't handle JSArray with hole values
properly on the fast path. Even though the JSArray is a fast one and
Array prototype and Symbol.iterator in untouched the hole values must
be converted to undefined because conversion of a value to number
might modify the Array's prototype chain and thus alter the result of
reading a hole from a temporary JSArray object created as a part of
IteratorToList step.
Bug: chromium:1470560
Change-Id: I6395df541aa41675df63c9d8dad86b0201cf8fed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4852525
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#89927}
... even if the embedder's FailedAccessCheckCallback forgets to do so.
This cleans up handling of failed access checks and removes
unnecessary d8 flags --throw-on-failed-access-check and
--noop-on-failed-access-check.
Drive-by: Fix discovered issue with propagation of exceptions in
v8::Object::DefineOwnProperty and v8::Object::DefineProperty.
Bug: v8:13825, chromium:1453572
Change-Id: I4d91ac8f9115ea9d20a0aa8a079c862a01198715
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4594617
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#89766}
1) expose FunctionCallbackInfo field offsets and size via
FunctionCallbackArguments class,
2) [x64] make ExitFrameStackSlotOperand() accept offsets instead of
slot indicies,
3) [ia32] rename ApiParameterOperand() to ExitFrameStackSlotOperand()
and make it accept offsets instead of indices,
4) move all ExitFrameStackSlotOperand() to macro-assembler-XX.h,
5) move CallApiFunctionAndReturn() function from builtins-XX.cc to
macro-assembler-XX.cc without any changes.
These are preliminary steps for inlining Api call builtin into Maglev.
Bug: v8:13825, chromium:1445925
Change-Id: Ida22ce8fe9a2b84aa48a4847d3642201abc26556
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4712105
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#89155}
... by parsing just the class body block.
Previously, when class member initializer functions were reparsed we
parsed the whole class declaration from scratch and then took only
the resulting instance/static member initializer function from the
class literal while throwing everything else away.
Such an approach works fine for most of the cases however some
expressions in the "extends" clause might require all class outer
scopes to be in place while some of them might not be available
anymore after scopes chain deserialization (i.e. they might be
optimzed away if the respective context objects don't have to be
allocated).
The solution is to parse just the class body. In order to achieve
that we
- record class body positions as start/end positions for class member
initializer functions,
- record class name in a member initializer function (it might be
necessary for creating proper class variable in the class scope).
We explicitly ignore the existence of the extends clause in the
original class definition since it only affects the resulting
class function's functions kind and parsing of 'super' expressions
(which might cause SyntaxErrors in non-derived classes).
The class constructor function is thrown away anyway when we reparse
a class member initializers and SyntaxErrors must have been thrown
during initial parsing, thus we can parse the class as a derived one.
Bug: chromium:1458565
Change-Id: Ie8c281cec90262f5955a3eacc21aebb2cf3de365
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4681439
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#89089}
Igor Sheludko